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Abstract — In this paper propose security issues and its solution for WiMAX network. Jamming and g 
Scrambling is main security issues regarding Physical Layer. The lack of Physical infrastructure 
wireless networks is inherently less secure. In this paper propose security issues and its solution 
WiMAX network. Jamming and Scrambling is main security issues regarding Physical Layer. Th^iUck ^f 
Physical infrastructure of wireless networks is inherently less secure. The performance anaimft^tJihe 
WiMAX system has been carried out for single and multicarrier jamming. It has been foifft^fcat the 
performance of the system varies significantly with different jamming signals. The periftrrr^jjJce of the 
WiMAX system has been studied under the influence of the basis of Modulation sche*n^(^PSK, BPSK, 
16 QAM and 64 QAM), Types of antennas (Sector antenna, Omni directional a4&r™ri8rand isotropic 
antenna) and Throughput on the basis of number of subcarriers destroyed. On^emasis of simulation 
results and performance analysis found that the performance of BPSK a^id iJftWWs better than other 
modulation scheme under single carrier jamming. WiMAX sector anlKol^^pIs better performance 
than isotropic and WiMAX Omni antennas. Throughput is reduced wl % ^ktxh|ubcarriers are destroyed 
in uplink and downlink. Uplink is more sensitive to data subcarrie^e«icti6n compare to downlink. 
The performance of the downlink PUSC is better than uplinjQjUs^ under the influence of the 
multicarrier jamming. 

Keywords — WiMAX, Physical Layer, Network Layer, OPN^T ^lodeler, QoS, Security 




I. IntaqWAtion 

Security has become a primary concern irfHfflder to provide protected communication in Wireless 
environment. It is know that the basic#^mcept of communication is to send the information from 
source node to destination node.To srffVfs^ully deploy multihop WiMAX networks, security is one of 
the major challenges that must ^^Wressed. Another important issue is ways to support different 
services and applications in WiM^Xletworks. Nevertheless, observed that the security mechanism of 
IEEE 802.16 is mainly focuse^^^ecurity in the MAC layer, which may not be able to provide sufficient 
security in multihop sd(£nario^and satisfy the requirements of emerging applications in WiMAX 
networks. 

WiMAX has sec Ajt j ^ ^frerabilities in both PHY and MAC layers, exposing to various classes of wireless 
attack includingTnfWception, fabrication, modification, and replay attacks [7]. Some vulnerabilities of 
WiMAX oriail^^from flaws of IEEE 802.16 on which WiMAX is based. A lot of problems and flaws 
have beejj^rec^n the enhanced version but WiMAX still has some exposes. In this section some 
possiMe\hr«ts or vulnerabilities will be reviewed. 




year 2000, users of the Internet accessed its contents primarily through wired, fixed 
ructure sites (e.g., universities, home dial-up connections, and corporate and government 

D-^cTTities). However, technology has evolved such that a significant number of users today access 
Internet services wirelessly. The cumulative result has created an information-centric society where 
users rely on network services in most aspects of their day-to-day life. The emerging wireless Internet 
architecture aims to continue the access revolution by supporting an increasing number of users at 
increased data rates, such that the user experience is similar to the experience from a wired, high-speed 
connection. A variety of wireless technologies have been proposed, both in standards organizations and 
by industry consortiums, to enable wireless network access. 
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II. Threats to The PHY layer 

WiMAX security is implemented in the security sub-layer which is above the PHY layer. Therefore the 
PHY is unsecured [6] and it is not protected from attacks targeting at the inherent vulnerability of 
wireless links such as jamming, scrambling or water torture attack. WiMAX supports mobility, thus it is 
more vulnerable to these attacks because the attackers do not need to reside in a fixed place and the 
monitoring solutions presented below will be more difficult.h 



1) Jamming attack: Jamming is described by M.Barbeau as an attack "achieved by introducing a 
source of noise strong enough to s significantly reduce the capacity of the channel" [6] . Jamming* 
can be either intentional or unintentional. It is not difficult to perform a jamming attack becau\e 1 
necessary information and equipment's are easy to acquire and there is even a book byNPois^l 
[10] which teaches jamming techniques. \^^J 

2) Scrambling attack: Also described in [5], scrambling is a kind of jamming but odkpfcfoked for 
short intervals of time and targeted to specific WiMAX frames or parts of fiAie^at the PHY 
layer. Attackers can selectively scramble control or management informat^^nr>rder to affect 
the normal operation of the network. Slots of data traffic belonging to ^he ik^eted SSs can be 
scrambled selectively, forcing them to retransmit. It is more diff^cukflfc^pWform a scrambling 
attack than to perform a jamming attack due to "the need, by tJ^^J^Ji^r, to interpret control 
information and to send noise during specific intervals" [5] . 



3) Water torture attack: According to D. Johnson and J. Wa jp^ j^jr this is also a typical attack in 
which an attacker forces a SS to drain its battery or coadfcm^fcmputing resources by sending a 
series of bogus frames. This kind of attack is considerqfi^en more destructive than a typical 
Denial-of-Service (DoS) attack since the SS whicji^g a^usually portable device is likely to have 
limited resources. 





4) Other threats: In addition to threats frorq^mrmhg, scrambling and water torture attacks, 802.16 
is also vulnerable to other attacks such#^V)rgery attacks in which an attacker with an adequate 
radio transmitter can write to a wirel^acrmnnel [3]. In mesh mode, 802.16 is also vulnerable to 
replay attacks in which an attacly^esends valid frames that the attacker has intercepted in the 
middle of forwarding (relayinejflw)c^s. 




O 




c<0 

Vy A Goal/Objective 

fa: 



The main Aim or goal (ftlk thesis is to introduce the WiMAX network, discuss its Architecture along 
with the brief expl jfffmfbtr of its Physical Layer and MAC (Media Access Control) Layer. Also the 
WiMAX networQfc^^j/emented with the help of OPNET Modeler Networking tool, the performance 
analysis of the nttMwk model is to be done along with resource allocation. Optimization of the network 
model is alscTwne on the basis of mutual collaboration between Subscriber Stations (SSs) and Base 
Stations J&faj^fhe WiMAX network Security is done on intrusion of Misbehaving Node attack. The 
SiimnWi ml J irameters and Result analysis is finally done for the above described network models. 

B The IEEE 802 Standard Families 

1 shows the structure of the IEEE 802 standards family of ratified technologies. IEEE 802 primarily 
focuses on the Physical (PHY) and Media Access Control (MAC) layer specifications of the 7-layer Open 
Systems Interconnection (OSI) model context. Such standards in the IEEE 802 family include the IEEE 
802.3 (wired Ethernet) standard, IEEE 802.1 (management) standard, IEEE 802.5 (token ring) standard, 
and the widely deployed IEEE 802.11 (wireless local area networks or WLAN) standard. WiMAX 
technology is primarily based on the IEEE 802.16 (Wireless Metropolitan Area Networks or WMAN) 
standard, while Bluetooth and ZigBee share similarities to some elements within the IEEE 802.15 
standard. 
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Fig i IEEE 802 Standards Family [8]. 

C Motivation 

With the recent success and wide adoption of IEEE 802.11 WLAN technology, IEEE 802 
other standards that aim to take the emerging wireless Internet architecture even fur 
technology is aimed at providing high-speed metropolitan area level access 
infrastructure but advertised as a fraction of the cost). The IEEE 8o2.i6e stand^S 
WMAN access to mobile users moving at vehicular speeds. ^ 

D Coverage Area of WiMAX Netwo^^^^ 



A notional view of an IEEE 802 wireless Internet architecture is pr 
network is deployed to enable connectivity across a large area_( 
km 2 ). 




loped 
E 802.16 
ar^ to cellular 
ims to provide 





Fig 2. Here, an IEEE 802.16 
order of a city, say around 100 





EEE 802 wireless internet architecture [1]. 

Within the IEEE 802.16 ^aetwor^Tisers (known as Subscriber Stations or SS) may access Base Stations 
(BS) directly or gatew^^^that bridge connections to other technologies (e.g., cellular, and wired 
infrastructure) may ]»A|ji#oyed. 



In the figure, mrelklocations are shown where connections are bridged between the IEEE 802.16 
network and^^S^>o2.n access point networks. Here, the IEEE 802.16 network acts as a backhaul 
network j^n^Je IEEE 802.11 networks provide localized coverage to individual users or other gateway 
node^((frilJe order of a city block, perhaps 10km 2 ). The gateway nodes shown in the IEEE 802.11 
netw^l^onnects via bridges to IEEE 802.15 wireless personal area networks (WPANs). These IEEE 
8^211^ networks may provide micro-local coverage (on the order of 10 ft 2 ) to devices such as cellular 
ones, computer mice, or household appliances. 

III. Parameter for Single Carrier Jamming 

This section provides the implementation of radio network with a mobile jamming node. Interference 
(radio noise) can decrease the Signal-to-Noise Ratio (SNR) in a radio-based network. Different types of 
antennas, such as directional antennas, can improve the SNR in a network by increasing the effective 
signal strength at the receiver. 

This model describes the effect of mobile jammer on receiver node with isotropic radiation pattern and 
direction antenna radiation pattern, the mobile jammer have straight trajectory. 
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A Network Model Components 



This network model topology consists of three nodes: 

• The Transmitter Node, 

• The Receiver Node and 

• The Mobile Jammer Node. 



The Transmitter Node: 



o 



The Transmitter Node transmits at uniform strength in all directions. The transmitter node mod 
consists of a packet generator module, a radio transmitter module, and an antenna module. ^h^p**k£t 
generator generates 1024-bit packets that arrive at the mean rate of 1.0 packets/second witJ^^\ofcrfant 
interarrival time. After they are generated, packets move through a packet stream Co/obe radio 
transmitter module, which transmits the packets on a channel at 1024 bits/second usk^^a^percent of 
the channel bandwidth. The packets then pass from the transmitter through anotlw j^ket stream to 
the antenna module. The node model for this Transmitter Node is shown in Fig 

cr 




Fig 3 Radio Transmittermfocj^MVlodel 



The parameters set on the radio_tx node are show 
Kbps), also the bandwidth and minimum freq 
minimum frequency specifies the base frequ 
node is set to BPSK (Binary Phase Shift Keyi 




4; here the data rate is set to 1024 bps (i.e. 1 
set to 10 KHz and 30 MHz respectively. The 
he channel. The modulation on this transmitter 





Value 



"3 



radio tx 



® 
® 

® 
® 

(D 
® 
® 
(D 
® 
® 



Rows 

data rate [bps] 
packet formats 
bandwidth (kHz) 
rmin frequency (MHz) 
spreading code 
power (W) 
bit capacity (bits) 
pk capacity (pks) 
modulation 
rxgroup model 
txdel model 
closure model 
chanmatch model 
tagain model 
propdel model 
icon name 
channel [0]. power 



1 



1,024 

all formatted, unformatted 
10 



30 

disabled 

promoted 

infinity 

1,000 

bpsk 



dra_rxgroup 

drajxdel 

dra_closure 

dra_chanmatch 

dra_tagain 

dra_propdel 

rajx 

promoted 



Fig 4 Simulation parameters on transmitter node 

The Receiver Node: 



The Receiver Node measures the quality of the signal emitted by the stationary transmitter node. It 
consists of an antenna module, a radio receiver module, a sink processor module, and an additional 
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processor module that works with the directional antenna. The node model for this Receiver Node is 
shown in Fig 5. 




Fig 5 Radio Receiver Node Model 
The Mobile Jammer Node: 



The Mobile Jammer Node creates radio noise. The jammer's trajectory 
range of the receiver node, increasing and decreasing interference at^J 
transmitter node, it consists of a packet generator module, a radio tr 
module. Its behavior is similar to that of the stationary transmitte 



\it w i and out of the radio 
eiver. Like the stationary 




odule, and an antenna 
^•idHj^Dut channel power and signal 
modulation is different. These differences will make packets trajigmfrtfd by the jammer node sound like 



noise to the receiver. The jammer node model is created from 



Radio Network 



of the transmitter node model. 



Performance of model with Isotropic and Dir 
mobile jammer having straight trajectory is s 4 
node denoted by (tx), radio receiver node 
with straight trajectory shown. 




Antenna Radiation Pattern The model with 
Fig 6; this model consists of radio transmitter 
by (rx) and mobile jammer node denoted by (jam) 





/^^^ Fig 6 Network model with mobile jammer having straight trajectory 

IV. Result Analysis (Single Carrier Jamming) 




ulation is done for 7 minutes, the graph of Bit Error Rate (BER) and Throughput (packets/sec) 
_e radio receiver node is shown in Fig 7 and Fig 8 respectively. There are two graphs in one figure, 
£ ^% the upper graph in each figure indicates the results when isotropic radiation pattern is present at the 
radio receiver and the lower graph in both the figure indicates the results when directional antenna 
pattern is used. 

From the graph of Bit Error Rate (BER) and Throughput (packets/sec), we can see that, when isotropic 
radiation pattern is used the average Bit Error Rate (BER) at the radio receiver increases and 
Throughput reduces due to large number of packet drops, which degrade the performance of the entire 
network. 
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Fig 7 Bit Error Rate (BER) Performance at Radio Receiver 



When the jammer node reaches nearer to receiver node the BER increases^y^k^^ 



from the receiver the BER decreases 



id 



Troughput (packets/sec) at Radio Receiver (rx) 



I jammer_mrt_net-antenna_test-DES-1 

radio receiver .throughput (packets/sec 




en it passes away 



roughput (packets/sec) at Radio Receiver 

The maximum BER is sfcfl^ta as 0.35 which is high when jammer is very close to receiver node, and the 
Throughput is near aJ^^^ro. When directional antenna pattern is used, the effect of jammer node 
does not affect tt%e r^^aJl, in this case the Bit Error Rate (BER) is very less which is near about zero and 
the Throughput/pafc^ets/sec) is maximum. Figure shows that the BER is 0.004 (~ °-°) an d Throughput 
is near about^^iict/sec. 





V. Simulation Parameters for Multi Carrier Jamming 



Di carrier jamming is difficult to simulate. In this thesis multi carrier jamming effect is modeled. 
1 duration is calculated by the following equation. In scalable OFDMA the symbol duration and 
, carrier spacing is fixed. Number of sub carriers and bandwidth is changed to keep symbol duration 
and sub carrier spacing fixed. 



T s =T b +T. 
b delta f 



(0 



(ii) 
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, t bandwidth 
delta f = x n 



subcarriers 



(iii) 



j = b 



8 



(iv) 



Where, n= sampling factor 
delta_f=tone spacing 



s _ 



= symbol duration 



T. 



£ = guard time 



^ = useful symbol duration 

Equation (IV) shows number of sub carriers is proportional to bandwidth of c 
OFDMA. It is multi carrier scheme. Multi carrier jamming scenario is shown in Fig 
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Fig. 9 Scenar 





to simulate multi carrier jamming. 



In this scenario fixed NLOS is co/tsH^ed. There are two subscriber stations. Application and profile 
node is used to create an apB^io^i^^rarameters associated with PUSC are shown in Table 1. 



le i PUSC Permutation Scheme for Uplink 





512 


1024 


Number of sub 
channels 


17 


35 


Data sub carriers used 
Pilot sub carrier 


272 




136 


280 


Left-guard sub carriers 


52 




Right-guard sub 
carriers 


5i 


9i 



Downlink PUSC permutation scheme is also used in simulation. Numbers of data, pilot and guard sub 
carriers required for scalable OFDMA are shown in the Table 2. 
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Table 2 PUSC Permutation Scheme for Downlink 





128 


512 


1024 


2048 

■ 


JMumDer 01 
sub channels 


3 




30 


DO 


Udld. SUD 

carriers used 


7 2 


3OO 


720 


~t A A /""\ 

1440 


Pilot sub 
carrier 


12 


60 


120 


240 


Left-guard 
sub carriers 


22 


46 


92 


184 


Right-guard 
sub carriers 


21 


45 


91 


183 



Steps involved in multi carrier jamming simulation are described below. 

1. Take the scenario as shown in Fig 9 Set the application which/! 
jamming effect. Select parameters for the same. 




examined under 



2. Now choose number of subscribers and base stations, ^er^yreiir attributes according to 
application. 

3. Set WiMAX attributes of all subscribers and base smmM*. Set the symbol duration according 
to standards. 

4. Set permutation mode as per the simulatio^n^ria. 

5. Now simulate the scenario and see tJj^\nrmighput and delay. 

6. Take new scenario as shown ijj^Fig 9and repeat step number 1 to 4. Reduce number of data 
or pilot or guard sub carri^^n^ uplink or downlink as per simulation criteria but keep 
symbol duration, sub carrjAspacing and bandwidth same as the first scenario. 



Now simulate t 
result. 



By following above sj 
The simulation 



errano and compare the throughput and delay result with previous 



tti carrier jamming effect can be simulated and results can be noted down. 
\rs are given in Table 3 

Table 3 Simulation parameters and their values 








^^klWrameter 


Value 




1 ^^^jfandwidth 


5 MHz for 512 sub carriers 




10 MHz for 1024 sub carriers 






Symbol duration 


102.86 u.seconds 


5 




Sub carrier spacing 


10.94 KHz 






Frame duration 


0.005 seconds 


5 


Duplexing technique 


TDD 


6 


Frame preamble (symbols) 


1 


7 


Transmit transition gap 


106 micro seconds 


8 


Receive transition gap 


60 micro seconds 




9 


Base frequency 


5 GHz 




10 


Sampling factor 


28/25 




11 


Efficiency mode 


Physical layer enabled 
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In Mobile WiMAX, the FFT size is scalable from 128 to 2,048. Here, when the available bandwidth 
increases, the FFT size is also increased such that the sub carrier spacing is always 10.94 kHz. This keeps 
the OFDM symbol duration, which is the basic resource unit, fixed and therefore makes scaling have 
minimal impact on higher layers. A scalable design also keeps the costs low. The sub carrier spacing of 
10.94 kHz was chosen as a good balance between satisfying the delay spread and Doppler spread 
requirements for operating in fixed and mobile environments. This sub carrier spacing can support 
delay-spread values up to 20 micro seconds and vehicular mobility up to 125 km per hour when 
operating in 3.5GHz. A sub carrier spacing of 10.94 kHz implies that 128, 512, 1,024, and 2,048 FFT are 
used when the channel bandwidth is 1.25MHz, 5MHz, 10MHz, and 20MHz, respectively. 2-11 GHz is 
used for Fixed NLOS and 2-6 GHz is used for mobile NLOS. It should, however, be noted that mobile V] 



WiMAX may also include additional bandwidth profiles. For example, a profile compatible with Wi 
will use an 8.75MHz channel bandwidth and 1,024 FFT. This obviously will require different sur^iarrie^r 
spacing and hence will not have the same scalability properties. The number of sub carriers f^^J^^iz, 
1024 and 2048. Data sub carriers, Null sub carriers and Pilot sub carriers are also given for J^^^4 an d 
2048 sub carriers. The WiMAX configuration node is used to configure WiMAX properties.^fE^8o2.i6e 
uses fixed and mobile NLOS. There are two sub carrier permutation modes FUSjS^f?^ usage sub 
carrier) and PUSC (partial usage sub carrier). ^X.^ 

Uplink and downlink both can use different permutation modes in single a&pbmimn. In uplink PUSC 
sub carrier permutation is given in Table 1 [16]. Same way in Downlink QU^Aulycarrier permutation is 
given in Table 2 [1]. In Simulation depending on number of sub carri^^fccraermutation scheme used 
parameters are chosen from the given tables. ^^S^ 

. Result and Analysis (Multipara<^C^Jfcr Jamming) 

In this scenario two subscriber stations and one base statiVi a^e there. Any application can be used to 
simulate multi carrier jamming. In this scenario Videj^oCTI^rencing application is chosen. Number of 
sub carriers chosen for this application is 512 and hAnlhwcrch is 5 MHz for this application. The symbol 
duration is 102.86 micro seconds and sub carrie^ro^mg i s 10.94 KHz. Uplink and downlink both use 
PUSC. Take new scenario as shown in Fig. 9 <S|Akeep all the parameters same except number of sub 
carriers and bandwidth. Now choose 1024 su%^^rriers and 10 MHz the results for scalability property 
are shown in Fig. 10 and Fig. 11. Simulatiila time is set to 300 seconds. Throughput and delay of whole 
system is considered in the results. Thrtkst^rn throughput is the sum of all data rates that are delivered 
to all terminals in a network. Delaj^i^urie tak 
time it leaves the source. ^ # ^ J 
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Fig 11 Delay vs. simulation time 
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New scenario is taken as shown in Fig. 9 to simulate multi carrier jamming effect. Sampling factor n is 
28/25 and number of sub carriers are 1024. This scenario is run for 300 seconds. Bandwidth is 10 MHz, 
sub carrier spacing is 10.94 KHz same as second scenario. Data sub carriers in uplink PUSC and 
downlink PUSC are 560 and 720 respectively. Number of sub channels in uplink PUSC and downlink 
PUSC are 35 and 30 respectively. Now follow the steps that are already mentioned in simulation section 
to simulate multi carrier jamming. Procedure to simulate multi carrier jamming is already mentioned. 
In uplink the effect of data sub carrier reduction is more compare to that in downlink. Results for 
uplink multi carrier jamming are shown in Fig. 12 and Fig 13. Here Fig. 10 and Fig 11 show the effect of 
scalability property of OFDMA on throughput and delay. Fig 10 shows the throughput for 512 and 1024 
sub carriers. Bandwidth is different for both the case. 1024 sub carriers produce more throughput thaj^^^J 
512 sub carriers. Fig 11 shows delay. The symbol duration and sub carrier spacing keep same for both fcj 
and 1024 sub carriers but the number of sub carriers and bandwidth is changed. Fig. 12 and fig.^shqw 
the effect of number of data sub carrier reduction on throughput and delay in uplink. Thf^ull^^t is 
decreased as numbers of data sub carriers are destroyed. ^^^V 
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Fig 12 throughput vs. simulation tifcr for uplink 
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g 13 Delay vs. simulation time for uplink 
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Fig. 14 Throughput vs. simulation time for downlink 

In this thesis only data sub carriers are destroyed and effect is noted down. If pilot sub carriers are 
destroyed then channel estimation becomes very difficult. Multi carrier jamming effect on throughput 
and delay in downlink is shown below. Fig. 12 shows throughput with all data sub carriers, with 288 
destroyed data sub carriers, with 320 destroyed data sub carriers. Throughput vs. simulation time in 
downlink is shown in Fig 14. Delay vs. simulation time in downlink is shown in Fig 15. The performance 
of downlink PUSC is better than uplink PUSC. More number of data sub carriers present in downlink 
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PUSC than uplink PUSC is first reason. The second reason is downlink PUSC scheme itself which is 
described in detail in theory part. 
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Fig. 15 Delay vs. simulation time for downlink 

vii. Conclusions 



The performance of BPSK and QPSK is better than other modulation scheme^mwef^single carrier 
jamming. WiMAX sector antenna gives better performance than isotropic and Vfr^I^K Omni antennas. 

dokmlink. Throughput is 



Throughput is decreased when data sub carriers are destroyed in uplink 
reduced means BER is increased. Delay is increased when data sub carr*#3^^Westroyed in uplink and 
downlink. Uplink is more sensitive to data sub carrier reduction c<3^3c!|^y downlink. Both single 
carrier jamming and multicarrier jamming are destructive in na^rrtjphgle carrier jamming can be 
detected easily compared to multi carrier jamming. The perforrr%p(^ of the downlink PUSC is better 
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